Introduction

Entanglement is the characteristic of quantum mechanics and key resource in quantum information processing1,2,3. As typical examples of bipartite and multipartite entangled states, the Bell state and Greenberger–Horne–Zeilinger (GHZ) states4,5 play crucial roles in numerous quantum information processing tasks and in foundational studies, such as quantum teleportation6,7,8, quantum key distribution9,10, quantum random number generation11, and nonlocality tests12,13. Furthermore, as a special example of graph states14, GHZ states are useful to constructing quantum networks15,16 designed for distributed quantum information processing, such as quantum secret sharing17,18, quantum conference key agreement19, and distribution20.

To guarantee the proper functioning of a quantum network, it is essential to verify the entangled state deployed in the network accurately and efficiently, especially for untrusted networks21,22,23,24,25,26,27,28,29. This scenario has wide applications in quantum information processing, such as one-sided device-independent (DI) quantum key distribution30, anonymous communication31,32, and verifiable quantum secure modulo summation33. Meanwhile, this problem is tied to the foundational studies on quantum steering in the asymmetric scenario3,34,35,36 and the uncertainty principle in the presence of quantum memory37,38.

Unfortunately, not much is known about quantum verification in untrusted networks despite its significance. This is because not all parties in the networks are honest, and the verification problem gets much more complicated in the presence of dishonest parties. In particular, traditional tomographic approaches are not applicable in the network setting even if their low efficiency is tolerable. Also, most alternative approaches, including direct fidelity estimation39 and quantum state verification (QSV)40,41,42,43,44,45, are not applicable, although QSV can address the adversarial scenario in which the source is not trustworthy43,44,45. DI QSV46 based on self-testing22,47,48,49,50,51,52 can be applied in the network setting in principle, but is too resource consuming and too demanding with current technologies. For the Bell state and GHZ states, optimal verification protocols are known when all parties are honest42,53,54,55,56,57,58. In the network setting, however, only suboptimal protocols are known in the literature23,24,25,26,29.

In this paper, we propose a simple approach for verifying the Bell state over an untrusted network in the semi-device-independent (SDI) scenario in which one party is not honest. Only local projective measurements are required for the honest party. In addition, we establish a simple connection between verification protocols of the Bell state and probability distributions on the Bloch sphere and reveal an intuitive geometric interpretation of the performance of each verification protocol. By virtue of this geometric picture, we construct the optimal and simplest protocols for verifying the Bell state, which can also be applied to detecting entanglement in the untrusted network. Moreover, we determine the sample efficiencies of our SDI verification protocols in addition to the guessing probabilities.

Furthermore, we establish an intimate connection between the verification of GHZ states and the verification of the Bell state. Thanks to this connection, efficient protocols for verifying GHZ states can easily be constructed from the counterparts for the Bell state. Notably, this connection enables us to construct the optimal protocol for verifying GHZ states and for detecting genuine multipartite entanglement (GME). To put our work in perspective, we also provide a detailed comparison between SDI QSV considered in this work and standard QSV as well as DI QSV based on self-testing. For the Bell state and GHZ states, SDI verification can achieve almost the same sample efficiency as standard QSV; by contrast, the sample efficiency in the DI scenario is in general quadratically worse in the infidelity unless there exists a suitable Bell inequality for which the quantum bound coincides with the algebraic bound.

Results

Verification of the Bell state

Suppose two distant parties, Alice and Bob, want to create the Bell state \(\left|{{\Phi }}\right\rangle =(\left|00\right\rangle +\left|11\right\rangle )/\sqrt{2}\) as follows: Bob first prepares \(\left|{{\Phi }}\right\rangle\) in his lab and then sends one particle of the entangled pair to Alice using a quantum channel. To verify this state Alice can perform a random projective measurement from a set of accessible measurements and then ask Bob to guess the measurement outcome given the measurement chosen. Each projective measurement is specified by a unit vector r on the Bloch sphere, which specifies the two outcomes \({P}_{\pm }=({\mathbb{I}}\pm {{{\boldsymbol{r}}}}\cdot {{{\boldsymbol{\sigma }}}})/2\), where σ is the vector composed of the three Pauli matrices. If Bob is honest and prepares the target state \(\left|{{\Phi }}\right\rangle\), then his reduced states corresponding to the two outcomes P+ and P− have mutually orthogonal supports, so he can guess the measurement outcome with certainty by performing a suitable projective measurement.

If Bob is not honest and tries to prepare a different state ρ instead of \(\left|{{\Phi }}\right\rangle\), then his guessing probability—the probability of successful guess—would be limited. In this case, Alice cannot distinguish two states that can be turned into each other by local operations of Bob; nevertheless, she can verify whether the state prepared is indeed \(\left|{{\Phi }}\right\rangle\) up to these local operations. Let \({\rho }_{\pm }={{{\mathrm{tr}}}}_{A}(\rho {P}_{\pm })\) be the unnormalized reduced states of Bob. To guess the measurement outcome of Alice, Bob can perform a two-outcome POVM {E+, E−} to distinguish ρ+ and ρ−. By the Helstrom theorem59, the maximum guessing probability γ(ρ, r) over all POVMs (or projective measurements) is given by the formula γ(ρ, r) = (1 + |∣ρ+ − ρ−∣∣1)/2.

Recall that a general two-qubit state has the form

$$\rho =\frac{1}{4}\left({\mathbb{I}}+{{{\boldsymbol{a}}}}\cdot {{{\boldsymbol{\sigma }}}}\otimes {\mathbb{I}}+{\mathbb{I}}\otimes {{{\boldsymbol{b}}}}\cdot {{{\boldsymbol{\sigma }}}}+\mathop{\sum}\limits_{j,k}{T}_{jk}{\sigma }_{j}\otimes {\sigma }_{k}\right),$$
(1)

where σj, σk are Pauli matrices (also denoted by X, Y, Z), a and b are the Bloch vectors of the two reduced states, and T is the correlation matrix. If ρ is pure, then we can deduce (cf. Supplementary Note 1),

$$\gamma (\rho ,{{{\boldsymbol{r}}}})=\frac{1}{2}\left(1+| | {T}^{{{{\rm{T}}}}}{{{\boldsymbol{r}}}}| | \right)=\frac{1}{2}\left(1+| | \sqrt{T{T}^{{{{\rm{T}}}}}}\ {{{\boldsymbol{r}}}}| | \right).$$
(2)

To understand the geometric meaning of γ(ρ, r), note that the set of vectors \(\{\sqrt{T{T}^{{{{\rm{T}}}}}}\ {{{\boldsymbol{r}}}}:| {{{\boldsymbol{r}}}}| =1\}\) forms a rotational ellipsoid, which is called the correlation ellipsoid and denoted by \({{{{\mathscr{E}}}}}_{\rho }\) (cf. the steering ellipsoid60,61), as illustrated in Fig. 1. The semi-major axis v and semi-minor axis of \({{{{\mathscr{E}}}}}_{\rho }\) have length 1 and C, respectively, where C is the concurrence of ρ1,62. In addition, the radius \(| | \sqrt{T{T}^{{{{\rm{T}}}}}}\ {{{\boldsymbol{r}}}}| |\) is determined by C and the angle between r and the semi-major axis as follows,

$$| | \sqrt{T{T}^{{{{\rm{T}}}}}}\ {{{\boldsymbol{r}}}}| | =| | {T}^{{{{\rm{T}}}}}{{{\boldsymbol{r}}}}| | =\sqrt{{C}^{2}+(1-{C}^{2}){({{{\boldsymbol{r}}}}\cdot {{{\boldsymbol{v}}}})}^{2}}.$$
(3)
Fig. 1: Geometric illustration of the XYZ protocol in the Bloch sphere.
figure 1

For a given concurrence C, the guessing probability is maximized when the semi-major axis v of the correlation ellipsoid parallels one of the eight intelligent directions.

Full size image

A verification strategy of Alice is determined by a probability distribution μ on the Bloch sphere, which specifies the probability of performing each projective measurement. Given the strategy μ and the state ρ, the maximum average guessing probability of Bob reads

$$\gamma (\rho ,\mu ):= \int {{{\rm{d}}}}\mu ({{{\boldsymbol{r}}}})\gamma (\rho ,{{{\boldsymbol{r}}}})=\frac{1}{2}+\frac{1}{2}\int {{{\rm{d}}}}\mu ({{{\boldsymbol{r}}}})| | {T}^{{{{\rm{T}}}}}{{{\boldsymbol{r}}}}| | ,$$
(4)

where the bias is a weighted average of radii of the correlation ellipsoid. Denote by γ2(C, μ) the maximum guessing probability over all pure states with concurrence at most C. Note that maximizing γ(ρ, μ) for a given concurrence amounts to choosing a proper orientation of the correlation ellipsoid so as to maximize the weighted average of radii, as illustrated in Fig. 1. This intuition leads to the following theorem as proved in Supplementary Note 1.

Theorem 1

Suppose 0 ≤ C ≤ 1; then

$${\gamma }_{2}(C,\mu )=\frac{1}{2}[1+g(C,\mu )],$$
(5)
$$g(C,\mu ):= \mathop{\max }\limits_{{{{\boldsymbol{v}}}}}\int {{{\rm{d}}}}\mu ({{{\boldsymbol{r}}}})\sqrt{{C}^{2}+(1-{C}^{2}){({{{\boldsymbol{r}}}}\cdot {{{\boldsymbol{v}}}})}^{2}},$$
(6)

where the maximization in Eq. (6) is over all unit vectors.

Any unit vector v that maximizes the integration in Eq. (6) is called an intelligent direction. For a given concurrence, the guessing probability is maximized when the major axis of the correlation ellipsoid parallels an intelligent direction. When C = 1, the correlation ellipsoid is a sphere, in which case Theorem 1 yields g(C, μ) = 1 and γ2(C, μ) = 1. When C = 0, the correlation ellipsoid reduces to a line segment, in which case we can deduce

$${g}^{* }(\mu ):= g(0,\mu )=\mathop{\max }\limits_{{{{\boldsymbol{v}}}}}\int {{{\rm{d}}}}\mu ({{{\boldsymbol{r}}}})| {{{\boldsymbol{r}}}}\cdot {{{\boldsymbol{v}}}}| ,$$
(7)
$${\gamma }_{2}^{* }(\mu ):= {\gamma }_{2}(0,\mu )=\frac{1}{2}+\frac{1}{2}\mathop{\max }\limits_{{{{\boldsymbol{v}}}}}\int {{{\rm{d}}}}\mu ({{{\boldsymbol{r}}}})| {{{\boldsymbol{r}}}}\cdot {{{\boldsymbol{v}}}}| .$$
(8)

Notably, entanglement can be certified in the shared system when the guessing probability surpasses the threshold \({\gamma }_{2}^{* }(\mu )\). The relation between the guessing probability and concurrence for various verification protocols is illustrated in Fig. 2.

Fig. 2: The guessing probability γ(C) = γ2(C) as a function of the concurrence C for various verification protocols of the Bell state.
figure 2

Here the XY protocol and isotropic protocol are introduced in the main text, while other protocols are proposed in the Supplementary Material.

Full size image

Alternative strategies of the adversary

So far we have assumed that the state ρ prepared by Bob is a two-qubit pure state and \({\rho }_{A}:= {{{\mathrm{tr}}}\,}_{B}(\rho )\) is supported in the local support of the target Bell state, that is, the subspace spanned by \(\left|0\right\rangle\) and \(\left|1\right\rangle\). Can Bob gain any advantage if ρA is not supported in this subspace? The answer turns out to be negative. Now Alice can first perform the projective measurement \(\{{P}_{A},{\mathbb{I}}-{P}_{A}\}\) with \({P}_{A}=\left|0\right\rangle \left\langle 0\right|+\left|1\right\rangle \left\langle 1\right|\) and then apply a verification protocol as before if she obtains the first outcome and reject otherwise. The maximum guessing probability γ(C, μ) of Bob for any pure state with C(ρ) ≤ C is the same as before as shown in the following lemma and proved in Supplementary Note 3.

Lemma 1

γ(C, μ) = γ2(C, μ) for 0 ≤ C ≤ 1.

Note that γ(C, μ) = 1 when C ≥ 1, in which case Bob can prepare the target Bell state. So we can focus on the case 0 ≤ C ≤ 1. Define γ*(μ) ≔ γ(0, μ), then \({\gamma }^{* }(\mu )={\gamma }_{2}^{* }(\mu )\) thanks to Lemma 1, so the threshold for entanglement detection remains the same as before; cf. Eq. (8). In conjunction with the convexity of γ2(C, μ) in C (cf. Lemma S1 in Supplementary Note 2), Lemma 1 implies that

$$\gamma (C,\mu )={\gamma }_{2}(C,\mu )\le {\gamma }^{* }(\mu )(1-C)+C,\,\ 0\le C\le 1,$$
(9)

which offers the best linear upper bound for γ(C, μ). When the distribution μ is clear from the context, γ*(μ) is abbreviated as γ* for simplicity.

Above results can be extended to mixed states, although our main interest are pure states. Let \(\hat{\gamma }(C,\mu )\) be the maximum guessing probability of Bob over all states with concurrence at most C. Define \({\hat{\gamma }}_{2}(C,\mu )\) in a similar way, but assuming that ρA is supported in the support of PA. By the following theorem proved in Supplementary Note 4, \(\hat{\gamma }(C,\mu )\) and \({\hat{\gamma }}_{2}(C,\mu )\) are weighted averages of γ*(μ) and γ(1, μ) = 1.

Theorem 2

Suppose 0 ≤ C ≤ 1; then

$$\begin{array}{ll}\hat{\gamma }(C,\mu )&={\hat{\gamma }}_{2}(C,\mu )=(1-C){\gamma }^{* }(\mu )+C\\ &=\frac{1+C}{2}+\frac{1-C}{2}\mathop{\max }\limits_{{{{\boldsymbol{v}}}}}\int {{{\rm{d}}}}\mu ({{{\boldsymbol{r}}}})| {{{\boldsymbol{r}}}}\cdot {{{\boldsymbol{v}}}}| .\end{array}$$
(10)

Fidelity as the figure of merit

Next, we consider the fidelity as the figure of merit, which is more natural for QSV. Here we assume that Bob controls the whole system except that of Alice, so we can assume that the state ρ prepared by Bob is pure. Define the reduced fidelity

$${F}_{B}(\rho ):= \mathop{\max }\limits_{{U}_{B}}\ \left\langle {{\Phi }}\right|({{\mathbb{I}}}_{A}\otimes {U}_{B})\rho {({{\mathbb{I}}}_{A}\otimes {U}_{B})}^{{\dagger} }\left|{{\Phi }}\right\rangle ,$$
(11)

where the maximization is taken over all local unitary transformations on \({{{{\mathcal{H}}}}}_{B}\). Denote by γF(F, μ) the maximum guessing probability over all pure states with FB(ρ) ≤ F. Define \({\gamma }_{2}^{{{{\rm{F}}}}}(F,\mu )\) in a similar way, but assuming that ρA is supported in the support of PA. It is known that FB(ρ) = [1 + C(ρ)]/2 ≥ 1/2 for any two-qubit pure state ρ satisfying PAρA = ρA63. So \({\gamma }_{2}^{{{{\rm{F}}}}}(F,\mu )\) is defined only for 1/2 ≤ F ≤ 1, although γF(F, μ) is defined for 0 ≤ F ≤ 1.

The following theorem proved in Supplementary Note 5 clarifies the relations between γF(F, μ), \({\gamma }_{2}^{{{{\rm{F}}}}}(F,\mu )\), and γ2(C, μ). The guessing probabilities γF(F, μ) for various verification protocols are illustrated in Fig. 3.

Fig. 3: Relation between the guessing probability γF(FB) and the reduced fidelity FB for various verification protocols of the Bell state.
figure 3

Here the XY protocol and isotropic protocol are introduced in the main text, while other protocols are proposed in the Supplementary Material.

Full size image

Theorem 3

Suppose 1/2 ≤ F ≤ 1; then

$${\gamma }_{2}^{{{{\rm{F}}}}}(F,\mu )={\gamma }_{2}(2F-1,\mu )\le 1-2(1-{\gamma }^{* })(1-F).$$
(12)

Suppose 0 ≤ F ≤ 1; then

$${\gamma }^{{{{\rm{F}}}}}(F,\mu )=\left\{\begin{array}{ll}2{\gamma }^{* }F\quad &0\le F < 1/2,\\ {\gamma }_{2}(2F-1,\mu )\quad &1/2\le F\le 1,\end{array}\right.$$
(13)
$${\gamma }^{{{{\rm{F}}}}}(F,\mu )\le 1-2(1-{\gamma }^{* })(1-F).$$
(14)

Equation (14) offers the best linear upper bound for γF(F, μ) when 1/2 ≤ F ≤ 1 and demonstrates the robustness of the verification protocol. Theorems 1 to 3 corroborate the significance of the threshold γ* in verifying the Bell state and entanglement in the SDI scenario. Moreover, the threshold γ* determines the sample efficiency, as we shall see shortly. Therefore, γ* can be regarded as the most important figure of merit for characterizing the performance of a verification protocol.

Simplest and optimal verification protocols

Here we propose several concrete verification protocols, including the simplest and optimal protocols. The main results are summarized in Table 1 and illustrated in Fig. 2; more details can be found in Supplementary Note 9.

Table 1 Concrete protocols for verifying the Bell state in an untrusted quantum network.
Full size table

In the simplest verification protocol, Alice can perform two projective measurements r1 and r2 with probabilities p1 and p2, respectively. Here the maximum guessing probability γ(C, μ) only depends on the angle between r1 and r2 in addition to the probabilities p1 and p2. Moreover, γ(C, μ) is minimized when r1 ⋅ r2 = 0 and p1 = p2 = 1/2, in which case we have

$$g(C,\mu )=\sqrt{\frac{1+{C}^{2}}{2}},\quad \gamma (C,\mu )=\frac{1}{2}+\frac{1}{2}\sqrt{\frac{1+{C}^{2}}{2}},$$
(15)

and the guessing probability threshold is \({\gamma }^{* }=(2+\sqrt{2})/4\). When r1 = (1, 0, 0)T and r2 = (0, 1, 0)T for example, we get the XY protocol. Previously, ref. 23 proposed an equivalent protocol, but neither derived the exact formula for the guessing probability nor proved the optimality of the XY protocol among all two-setting protocols.

To determine the optimal protocol, we need to minimize g(C, μ) over μ. By Theorem 1, g(C, μ) is convex in μ, so g(C, μ) is minimized when μ is the uniform distribution on the Bloch sphere, which yields the isotropic protocol with

$$g(C,\mu )=\frac{1}{2}+\frac{{C}^{2}{{{\rm{arcsinh}}}}\left(\frac{\sqrt{1-{C}^{2}}}{C}\right)}{2\sqrt{1-{C}^{2}}},$$
(16)
$$\gamma (C,\mu )=\frac{3}{4}+\frac{{C}^{2}{{{\rm{arcsinh}}}}\left(\frac{\sqrt{1-{C}^{2}}}{C}\right)}{4\sqrt{1-{C}^{2}}},$$
(17)

and the guessing probability threshold is γ* = 3/4.

Protocols based on the Pauli Z measurement and measurements on the xy-plane are of special interest to the verification of GHZ states as we shall see shortly. Prominent examples include the XYZ protocol (cf. Fig. 1), equator protocol, equator + Z protocol, polygon protocol, and polygon + Z protocol (see Supplementary Note 9).

Sample efficiency

To construct a practical verification protocol, it is crucial to clarify the sample efficiency. Although this problem has been resolved in standard QSV42,43,44, little is known about the sample efficiency in the DI and SDI scenarios46. Here we clarify the sample efficiency of our verification protocols in the SDI scenario. Consider a quantum device that is supposed to produce the target state \(\left|{{\Phi }}\right\rangle \in {{{\mathcal{H}}}}\), but actually produces the states ρ1, ρ2, …, ρN in N runs. Our task is to verify whether these states are sufficiently close to the target state on average. Here the reduced fidelity is a natural choice for quantifying the closeness since Alice is ignorant to the local unitary transformations acting on Bob’s system. To guarantee that the average reduced fidelity of the states ρ1, ρ2, …, ρN is larger than 1 − ϵ with significance level δ (confidence level 1 − δ), the number of tests required is determined in Supplementary Note 6, with the result

$$N=\left\lceil \frac{{{\mathrm{ln}}}\,\delta }{{{\mathrm{ln}}}\,[1-2(1-{\gamma }^{* })\epsilon \ ]}\right\rceil \approx \frac{{{\mathrm{ln}}}\,{\delta }^{-1}}{2(1-{\gamma }^{* })\epsilon }.$$
(18)

Note that the sample efficiency is determined by the threshold \({\gamma }^{* }={\gamma }_{2}^{* }\) defined in Eq. (8).

The minimum threshold γ* = 3/4 is attained for the isotropic protocol, in which case \(N\approx (2{{\mathrm{ln}}}\,{\delta }^{-1})/\epsilon\), which is comparable to the number \((3{{\mathrm{ln}}}\,{\delta }^{-1})/(2\epsilon )\) required in standard QSV42,53. So the Bell state can be verified in the SDI scenario almost as efficiently as in the standard QSV. Our protocol can achieve the optimal sample complexity because it is tied to a steering inequality whose quantum bound coincides with the algebraic bound. In contrast, the sample complexity in the DI scenario is quadratically worse in the scaling with 1/ϵ, that is, \(N\propto ({{\mathrm{ln}}}\,{\delta }^{-1})/{\epsilon }^{2}\) 46 (cf. Supplementary Note 7).

Verification of the GHZ state

Next, consider the GHZ state \(\left|{G}^{n}\right\rangle =({\left|0\right\rangle }^{\otimes n}+{\left|1\right\rangle }^{\otimes n})/\sqrt{2}\) of n-qubits with n ≥ 3. To verify this state, the n parties can randomly perform certain tests based on local projective measurements. In each test, the verifier (one of the parties) asks each party to perform a local projective measurement as specified by a unit vector on the Bloch sphere and return the measurement outcome. If all parties are honest, then only the target state \(\left|{G}^{n}\right\rangle\) can pass all tests with certainty, so the GHZ state can be verified. In the presence of dishonest parties, let \({{{\mathscr{D}}}}\) be the set of dishonest parties, who know which parties are honest or dishonest and who may collude with each other; let \({{{\mathscr{H}}}}\) be the set of honest parties (including the verifier), who do not know which other parties are honest or dishonest. The goal is to verify \(\left|{G}^{n}\right\rangle\) up to local unitary transformations on the joint Hilbert space of \({{{\mathscr{D}}}}\)23,24. Assuming \(| {{{\mathscr{D}}}}| ,| {{{\mathscr{H}}}}| \ge 1\), then \(\left|{G}^{n}\right\rangle\) may be regarded as a Bell state shared between \({{{\mathscr{H}}}}\) and \({{{\mathscr{D}}}}\). So the verification of the GHZ state is closely tied to the verification of the Bell state. Actually, there is no essential difference when \(| {{{\mathscr{H}}}}| =1\).

However, a key distinction arises when \(| {{{\mathscr{H}}}}| \ge 2\) because each member of \({{{\mathscr{H}}}}\) can only perform local projective measurements on his/her party. So the potential tests that the verifier can realize are restricted. Careful analysis in Supplementary Note 10 shows that only two types of tests for verifying the GHZ state \(\left|{G}^{n}\right\rangle\) can be constructed from local projective measurements. In the first type, all parties perform Z measurements, and the test is passed if they obtain the same outcome. In this way the verifier can effectively realize the Z measurement on \({V}_{{{{\mathscr{H}}}}}\), where \({V}_{{{{\mathscr{H}}}}}\) is the two-dimensional subspace spanned by \({\bigotimes }_{j\in {{{\mathscr{H}}}}}{\left|0\right\rangle }_{j}\) and \({\bigotimes }_{j\in {{{\mathscr{H}}}}}{\left|1\right\rangle }_{j}\).

In the second type of tests, party j performs the X(ϕj) measurement with \({\sum }_{j}{\phi }_{j}=0\,{{\mathrm{mod}}}\,\,2\pi\), where \(X({\phi }_{j})={{{{\rm{e}}}}}^{-{{{\rm{i}}}}{\phi }_{j}}\left|0\right\rangle \left\langle 1\right|+{{{{\rm{e}}}}}^{{{{\rm{i}}}}{\phi }_{j}}\left|1\right\rangle \left\langle 0\right|\) corresponds to the Bloch vector \({(\cos {\phi }_{j},\sin {\phi }_{j},0)}^{{{{\rm{T}}}}}\), and each ϕj is decided by the verifier. The test is passed if the number of outcomes −1 is even. Suppose ϕ1, ϕ2, …, ϕn are chosen independently and uniformly at random from the interval [0, 2π). Then \({\phi }_{{{{\mathscr{H}}}}}:= {\sum }_{j\in {{{\mathscr{H}}}}}{\phi }_{j}\,{{\mathrm{mod}}}\,\,2\pi\) is uniformly distributed in [0, 2π). Given ϕ ∈ [0, 2π), the average of \({\bigotimes }_{j\in {{{\mathscr{H}}}}}X({\phi }_{j})\) under the condition \({\phi }_{{{{\mathscr{H}}}}}=\phi\) reads

$$\bigg\langle\bigotimes_{j\in {\mathscr{H}}} X(\phi_j)\bigg\rangle_{\phi}={\mathrm{e}}^{-{\mathrm{i}}\phi}\bigotimes_{j\in {\mathscr{H}}}(\left|0\right\rangle\left\langle1\right|)_j +{\mathrm{e}}^{{\mathrm{i}}\phi}\bigotimes_{j\in {\mathscr{H}}}(\left|1\right\rangle\left\langle0\right|)_j.$$
(19)

In this way, the verifier can effectively realize the X(ϕ) measurement on \({V}_{{{{\mathscr{H}}}}}\), where ϕ is completely random. A similar result holds when ϕj are chosen independently and uniformly at random from the discrete set \({\{2k\pi /M\}}_{k = 0}^{M-1}\) with M ≥ 3 being a positive integer.

By the above analysis, the verifier can effectively realize projective measurements along the z-axis or on the xy-plane when represented on the Bloch-sphere of \({V}_{{{{\mathscr{H}}}}}\), but not other projective measurements (assuming \(| {{{\mathscr{H}}}}| \ge 2\)). Each verification protocol of the GHZ state corresponds to a probability distribution μ on the Bloch sphere that is supported on the equator together with the north and south poles. Moreover, for all protocols in Table 1 except for the isotropic protocol (cf. Supplementary Notes 9 and 10), the guessing probabilities are the same as in the verification of the Bell state. To be specific, γ(C, μ) and γF(F, μ) can be defined as before; Theorems 1, 3, and Lemma 1 still hold, except that now C refers to the bipartite concurrence between \({{{\mathscr{H}}}}\) and \({{{\mathscr{D}}}}\). Although variants of the XY protocol and equator protocol were proposed previously23,24, such exact formulas for the guessing probabilities are not known in the literature. To optimize the performance, μ should be uniform on the equator, which leads to the equator + Z protocol; the optimal probability pZ for performing the Z measurement depends on C or F as before.

A quantum state ρ is genuinely multipartite entangled (GME) if its fidelity with the GHZ state \({{\mathrm{tr}}}\,(\rho \left|{G}^{n}\right\rangle \left\langle {G}^{n}\right|)\) is larger than 1/264. The GME can be certified if the guessing probability surpasses the threshold γF(1/2) = γ*. This threshold is minimized at the special equator + Z protocol with pZ = 4/(4 + π2) = 0.288, in which case we have

$${\gamma }^{{{{\rm{F}}}}}(1/2)={\gamma }^{* }=\frac{1}{2}+\frac{1}{\sqrt{4+{\pi }^{2}}}\approx 0.769.$$
(20)

This threshold is only 2.5% higher than the optimal threshold 3/4 for certifying the entanglement of the Bell state based on the isotropic protocol.

The sample efficiency for verifying the GHZ state can be determined following a similar analysis applied to the Bell state. The formula in Eq. (18) still applies, except that the choice of verification protocols is restricted. Now the minimum of γ* is achieved at a special equator + Z protocol [cf. Eq. (20)]. So the GHZ state can be verified in the SDI scenario with almost the same efficiency as in the standard QSV57, as illustrated in Fig. 4. In the DI scenario, by contrast, it is in general impossible to achieve such a high efficiency unless one can construct a Bell inequality for which the quantum bound coincides with the algebraic bound46. Notably, the three-qubit GHZ state can be verified with such a high efficiency by virtue of the Mermin inequality46,50.

Fig. 4: Sample complexities for verifying the Bell state and GHZ states in three different scenarios.
figure 4

In standard QSV, the Bell state and GHZ states can be verified with the same sample complexity42,57. In the SDI scenario, the isotropic protocol is chosen for verifying the Bell state and the optimized equator + Z protocol is chosen for verifying the GHZ states. In the DI scenario, the Mermin inequality is employed for verifying the three-qubit GHZ state46,50. Here the significance level is chosen to be δ = 0.01.

Full size image

It should be pointed out that all our protocols for verifying GHZ states are applicable even in the presence of an arbitrary number of dishonest parties as long as the verifier is honest. Meanwhile, these protocols are useful for detecting GME. For some cryptographic tasks such as anonymous quantum communication, the security for all honest parties can be guaranteed at the same time with the assistance of a trusted common random source (CRS)23. In this case, the number of honest parties can affect the security parameter.

Discussion

We proposed a simple and practical approach for verifying the Bell state in an untrusted quantum network in which one party is not honest. We also established a simple connection between verification protocols of the Bell state and probability distributions on the Bloch sphere together with an intuitive geometric picture. Based on this connection, we derived simple formulas for the guessing probability as functions of the concurrence and reduced fidelity. Meanwhile, we clarified the sample efficiency of each verification protocol and showed that the sample efficiency is determined by the threshold in the guessing probability. Moreover, we constructed the optimal and simplest protocols for verifying the Bell state, which are also very useful to detecting entanglement in the untrusted network.

Furthermore, we reduce the verification problem of GHZ states to the counterpart of the Bell state, which enables us to construct the optimal protocol for verifying GHZ states and for detecting GME. Our work shows that both Bell state and GHZ states can be verified in the SDI scenario with the same sample complexity as in standard QSV. By contrast, the sample complexity in the DI scenario is in general quadratically worse. This work is instrumental to verifying entangled states in untrusted quantum networks, which is crucial to guaranteeing the proper functioning of quantum networks. In addition, this work is of intrinsic interest to the foundational studies on quantum steering. In the future, it would be desirable to generalize our results to generic bipartite pure states, stabilizer states, and other quantum states.